Case Studies / Rexig Realty Inc.

Rexig Realty Inc.

IT Manager and Manager of Cybersecurity
Mar 2023 - Mar 2025
SMB Commercial Real Estate 84 Staff Built from Zero
23% to 6%
phishing click rate - built from zero
84Staff
24Month program
18Simulation campaigns
0Social engineering incidents
01

The Challenge

Rexig Realty had no security awareness program when I joined as IT Manager and Manager of Cybersecurity in early 2023. What they had was a near-miss: a few months before my arrival, a real estate agent had received a convincing wire-fraud email during a property closing, spoofing the title company's instructions. The agent caught it - barely - but it surfaced just how exposed the organization was to the most common and most costly threat in commercial real estate.

Real estate is one of the highest-BEC-targeted sectors in North America. Closing wire fraud alone costs the industry hundreds of millions annually. A 23% baseline click rate in a firm processing high-value property transactions is not an abstract risk - it's a direct financial exposure on every deal in the pipeline.

I held dual accountability for the full IT function and cybersecurity. There was no security team to delegate to. The program had to be designed to run efficiently on a single operator's time budget while still producing meaningful, trackable behaviour change across 84 staff spanning agents, administrative staff, and leadership.

BASELINE - MAR 2023
23%Click rate (blind test)
0Prior awareness program
1Near-miss wire fraud incident
84Staff, 1 security person
02

Approach

PHASE 1 - MAR to JUN 2023
Baseline and Lunch-and-Learn Launch
Ran a blind baseline simulation and presented results to ownership and management. Followed immediately with a real-estate-specific threat briefing: a 45-minute lunch-and-learn focused entirely on wire fraud at closing, vendor invoice manipulation, and property listing portal credential theft - the three threat patterns most likely to cause direct financial loss in this specific business. Framing the threats in business language (not security language) drove early engagement and leadership buy-in.
Leadership buy-in secured on day one
PHASE 2 - JUL 2023 to JUN 2024
Monthly Simulations with Agent vs. Admin Segmentation
Launched a monthly simulation cadence segmented by role type: real estate agents (who handle closing transactions and client communication) received higher-frequency, closing-specific lures; administrative staff received broader credential-harvest and general-business scenarios. Click rate dropped from 23% to 12% by mid-2024. Just-in-time module delivery on click kept the remediation pipeline running without requiring any manual per-user follow-up.
Click rate: 12% by Jun 2024
PHASE 3 - JUL to DEC 2024
Wire Fraud Verification SOP
Beyond simulation, the most impactful operational change was a formal wire-transfer verification SOP: all closing wire instructions received via email required phone verification to the title company using a number sourced independently (not from the email itself). Combined with ongoing simulation pressure, click rate dropped to 8%. No social engineering attempts succeeded during this period despite two active credential-harvest campaigns observed targeting the commercial real estate sector in Ontario.
Wire fraud SOP deployed - zero incidents
PHASE 4 - 2025
Sustainment and Vendor Impersonation Focus
Final phase focused on title company and vendor impersonation scenarios - a threat pattern growing in frequency across the sector. Simulation cadence maintained at monthly. Click rate reached 6% and held. Monthly metrics deck delivered to the Managing Broker: one page, three numbers, trend line. Leadership could read it in 90 seconds.
Click rate: 6% - 0 incidents in 24 months
03

Results

Phishing Click Rate - Quarterly (Mar 2023 - Mar 2025)
Click Rate (%) - lower is better
0 6 13 20 26 Mar'23 Jun'23 Sep'23 Dec'23 Mar'24 Jun'24 Sep'24 Dec'24 Mar'25 Click Rate (%)
View data table
PeriodClick Rate (%)
Mar 202323
Jun 202319
Sep 202315
Dec 202312
Mar 202410
Jun 20249
Sep 20248
Dec 20247
Mar 20256
04

Campaign Library

BEC / WIRE FRAUD
Closing Wire Instructions Changed
Agents / Admin
41%
DOCUMENT DELIVERY
DocuSign Lease Agreement Ready
Agents
28%
CREDENTIAL HARVEST
Property Listing Portal Login
All Staff
19%
BEC / INVOICE FRAUD
Title Company Invoice - Payment Due
Admin / Accounting
22%
05

Tools and Stack

KnowBe4 (SMB Tier) Microsoft 365 Business Premium Monthly Metrics Deck (Excel to PDF) Wire Transfer Verification SOP

"We had one close call with wire fraud before Ben built this program. In two years since, we've had zero. That's the whole story. I can show leadership a one-page report every month and they actually understand what it means."

Managing Broker - Rexig Realty Inc.
06

Transferable Skills

›
Zero-budget, zero-team program design. Building a full awareness program as the sole IT and security resource - with no team, no dedicated budget beyond platform licensing, and no prior program to build on - demonstrates that the methodology is sound independent of enterprise tooling. The same four-phase framework that reduced BMO's click rate also works in a 84-person firm on a single operator's time.
›
Executive communication without jargon. The one-page monthly metrics deck - three numbers, one trend line, 90-second read - is the output format that gets awareness programs sustained at the SMB level. Translating security metrics into language that non-security leadership can act on is a skill directly applicable to City of Toronto stakeholder reporting requirements.
›
Sector-specific threat design. Closing wire fraud is to real estate what payment diversion is to public procurement. Building simulations around the actual transactions at risk - not generic "IT password reset" templates - produces faster and deeper behaviour change. That same sector-specific design logic applies to a municipal environment's specific threat patterns (procurement fraud, benefits administration, contractor payment diversion).
›
Process integration alongside awareness. The wire-transfer verification SOP is an example of pairing procedural controls with awareness training. Behaviour change alone isn't sufficient when the stakes are a single mis-directed wire. Building the operational process that catches what the training misses is the complete picture - and it's relevant to any City department handling high-value or irreversible transactions.